Privacy policy
DayQid · version v117 · last updated 8 November 2026
DayQid is a personal app run by its owner. It reads your Gmail read-only — and, if you connect it, your Microsoft Outlook mail and OneDrive files, also read-only — and turns them into one view of your day: bills and payments, bookings and passes, deadlines and appointments, and people waiting for a reply. This page describes what DayQid actually does in this version: what it reads, where that information is kept, what leaves your device, and how to remove it.
In short
- DayQid asks Google for one data permission: read your Gmail (
gmail.readonly). It cannot send, delete, label or change mail. - Microsoft is optional. If you connect it, DayQid asks Microsoft to read your Outlook mail (
Mail.Read) and read your OneDrive files (Files.Read). It cannot send, delete or change mail or files. - Your browser reads Gmail directly from Google and Outlook and OneDrive directly from Microsoft. Mail and files do not pass through any DayQid server.
- What DayQid works out from your mail is stored on your device (in your browser), not on a server.
- A small server (a Cloudflare Worker run by the owner) only keeps you signed in to Google (and Microsoft, if connected), and, if you switch it on, relays Ask AI questions to Google Gemini.
- No ads, no analytics, no tracking, no selling of data.
Google permissions
When you choose Continue with Google, Google's own consent screen asks you to allow:
openid,email,profile— to know which Google account is signed in (your name, email address and profile picture);https://www.googleapis.com/auth/gmail.readonly— to read messages and labels in your Gmail.
DayQid does not ask for permission to send, compose, modify or delete mail, or for Google Drive, Fit, Calendar, Tasks or Contacts. If a future version offers Calendar, Tasks or Contacts, it will ask for each one separately, only when you turn it on. An older, broader permission you may have given an earlier version is not used.
Microsoft permissions (optional)
Microsoft is an extra connection you can add in Settings → Accounts → Add account, next to Gmail. Personal accounts (Outlook.com, Hotmail, Live) and work or school accounts (Microsoft 365) can be connected. Microsoft's own consent screen asks you to allow:
openid,profile,email,User.Read— to know which Microsoft account is connected (name and email address);offline_access— so you stay connected without signing in to Microsoft every hour;Mail.Read— to read messages in your Outlook mailbox;Files.Read— to read the files in your own OneDrive.
DayQid does not ask Microsoft for permission to send, change or delete mail or files, for files other people shared with you, or for Calendar, Contacts or Teams. A work or school account may need your organisation's approval.
What DayQid reads from Outlook and OneDrive
- Outlook mail (Inbox, Sent Items and Archive, the last 30 days, then only changes) is handled exactly like Gmail: sender, recipients, subject, date, read state, Focused/Other and Microsoft's short preview; for messages that look like they matter, the message text is read in your browser to find amounts, due dates and references, and then discarded.
- OneDrive files: DayQid lists your files (name, type, folder, size, last change and a link to open them in OneDrive). Folders are not listed.
- File contents: only recent PDF, Word, Excel and text files whose name or folder looks like a bill, receipt, ticket or booking are opened — never files that look like identity, medical or payslip documents. The file is downloaded into your browser's memory directly from Microsoft, its text is read on your device to find amounts, due dates and references, and the file and its text are then discarded. You can turn this off in Settings → Microsoft; files are then only listed.
What DayQid reads from Gmail
- For recent mail (the last 30 days, and older bills only if you ask with Scan older bills), DayQid reads message headers (sender, recipients, subject, date and whether it comes from a mailing list), labels and Google's short preview.
- For messages that look like they matter (for example a bill, a payment, a booking or a request from a person), it also reads the message text in your browser to find amounts, due dates, references and similar facts. The message text is used in memory and then discarded; it is not saved.
- Attachments are not downloaded. DayQid may note an attachment's name, type and size.
What is stored on your device
Everything below lives in your browser's storage for this site (IndexedDB and local storage) on the device you use. It is not synchronised to a server and other devices cannot see it.
| What | Details |
|---|---|
Mail index (IndexedDB daylight-mail) | Per Google or Microsoft account: message and thread IDs, labels, sender, subject, Google's preview, dates, what DayQid concluded (for example "bill, 450 CZK, due 20 Nov") and why, a fingerprint (hash) of the text instead of the text itself, sync checkpoints and quota counters. Full message text is not stored. |
Your items (IndexedDB daylight-graph) | The cards you see: emails, OneDrive files (name, folder, size, date, link and any amount, due date or reference found in them — not their text), bills, payments, subscriptions, bookings, deadlines, appointments, people and organisations, Wallet passes and tasks, the links between them, your actions (done, snoozed, paid), your corrections and rules, and a log of anything that left your device. |
| Session and settings (local storage) | Your DayQid sign-in session ID, your Google name, email and picture address, the connected Microsoft account's name and email, sync checkpoints for Outlook and OneDrive, the permissions Google granted, which account is confirmed, theme and other preferences. |
Trial browser ID (local storage dayqid-device) | A random ID created by this browser (not derived from your device or anything about you). It is sent only when a free trial starts and is used only to count, for review, how many trials start from one browser — it never refuses a trial. "Delete data on this device" removes it. |
| Wallet and tasks (local storage) | Passes you add with the scanner (including the photo you took or chose, the text you confirmed and any code value), and tasks you create. |
The Google and Microsoft access tokens DayQid uses to read your mail and files expire within an hour. On your device they are kept in memory only. DayQid’s server keeps the latest one for each connected account, encrypted (AES-GCM), until it expires, so that your devices can share it instead of asking Google or Microsoft again; it is deleted when you disconnect that account or delete your DayQid account. To limit how often new ones are requested on each plan, the server also keeps the times of the last day’s requests (no token and no address in clear).
If several Google accounts are used in the same browser, only the signed-in account's items are shown; the others stay hidden and can be deleted from Settings. Tasks and Wallet passes you add yourself belong to the device and are visible to anyone using it.
The DayQid server (Cloudflare Worker)
Signing in goes through a small server run by the owner on Cloudflare Workers. It is used to:
- Sign you in and keep you signed in. After you approve on Google's screen, the server receives Google's long-term (refresh) token, encrypts it (AES-GCM) and stores it with your email address, the granted permissions and timestamps. Your session is stored under a SHA-256 fingerprint of its ID, not the ID itself. The names of these records (never their contents) are also registered with an identity guard for your anonymous DayQid account ID, together with a generation number and whether the account is active, so that deleting your account can find all of them and no record of a deleted account can be used again. The server uses the stored token only to give your browser short-lived access tokens. Sessions unused for 180 days are deleted automatically; temporary sign-in state is deleted after 10 minutes.
- Keep you connected to Microsoft, if you connect it. Microsoft's long-term (refresh) token is encrypted (AES-GCM) and stored in your DayQid session together with the Microsoft account's email address, name, granted permissions and an anonymous account fingerprint. Microsoft replaces this token each time it is used; DayQid keeps only the newest. It is deleted when you disconnect Microsoft or sign out of DayQid.
- Check the account is allowed. While DayQid is in testing, only Google accounts on the owner's allow-list can sign in.
- Relay Ask AI questions, only if you turn this on (see below). The server holds the Gemini API key and keeps an hourly request counter for your session (deleted after 2 hours).
- Know your plan and its limits. The server keeps, under your anonymous DayQid account ID, your plan (Free, Pro or Elite), whether it comes from a subscription or a beta grant, the country you chose for prices, how many accounts of each provider you have connected, and one record per Ask AI question you send (a random request ID and the date — never the question or the answer) to count your monthly allowance. No email address, name, mail or file content is kept with these records. Paid plans are not on sale yet; when they are, payments will be handled by a payment provider acting as the seller, and DayQid will receive only the subscription status, plan, price, currency and billing country — never card details. This section will be updated before paid plans start.
- Run the free trial — one per person in any 12 months. The trial starts after your first Gmail sync: the server then checks, with its own call to Gmail's profile (your mailbox address and its history position — no message), that your Gmail can be read; nothing from that answer is kept. You can also start it yourself 24 hours after creating your account. The trial is recorded under your DayQid account ID with its start and end date. To keep it to one per person, the server keeps two pseudonymised values — keyed hashes (HMAC-SHA-256 with a secret key only the server holds) of your email address (in a standard form, so that for example
a.b+x@gmail.comandab@gmail.comcount as one) and of your Google account ID. They are still personal data: anyone holding the key could check whether a given address had a trial. They are kept for 12 months, also after you delete your DayQid account (then without your account ID), so the rule is one free trial per person in any 12 months. Two further counts are kept only for review and never refuse a trial: how often the trial browser ID above started a trial (12 months) and how many trials started from your network address on one day (a keyed hash of the address, deleted after 48 hours). A beta tester's 30-day Pro access counts as their free trial. You can ask for the trial values to be erased by writing to support@dayqid.com; after that a new trial would be possible.
The server does not read, receive or store your mail or files. Cloudflare, as the host, may keep standard technical request logs (such as IP address and time) under its own policy.
Ask and AI
- Ask answers from the items already on your device, with sources. Nothing is sent anywhere.
- Ask AI is off by default. If you switch it on in the Privacy Centre and then tap Ask AI instead, DayQid sends your question and up to 60 of your items (title, sender, date, status and amount) through the DayQid server to Google's Gemini API, and shows only answer sentences that cite your items.
- Email bodies and file contents are never sent to AI. OneDrive files, identity documents, people and organisations are never sent. DayQid does not use AI to sort your incoming mail in this version.
- Every AI request is listed in Privacy Centre → What left your device.
- How Google handles Gemini requests is set by the Gemini API terms for the key the server uses. On Google's unpaid Gemini tier, Google may use prompts to improve its products.
Wallet scanner
- The camera picture and any photo you choose are processed in your browser and saved only on your device with the pass.
- QR codes and barcodes are read on your device: by the browser's built-in barcode reader where it has one, and otherwise by DayQid's own reader running in the page (QR codes and Code 128 barcodes). This works the same for photos you upload. DayQid keeps a code only if it was really found in the picture; a booking reference in the text is never turned into a code.
- When a pass is shown, its QR code or Code 128 barcode is drawn on your device from the stored value. No code value is sent to any image or decoding service. Other code types (such as PDF417 or Aztec) are shown as text with the original ticket recommended for scanning.
Other services your browser contacts
| Service | Why | What it receives |
|---|---|---|
| GitHub Pages | Hosts the app's files | Standard web requests (IP address, browser) |
| Google sign-in and Gmail API | Signing in and reading your mail | Your access token and Gmail requests, sent by your browser directly to Google |
| Google user content | Your profile picture | A request for the picture |
| Microsoft sign-in (if you connect Microsoft) | Connecting your Microsoft account | Your Microsoft sign-in, on Microsoft's own pages |
| Microsoft Graph (if connected) | Reading Outlook mail and your OneDrive file list | Your Microsoft access token and read requests, sent by your browser directly to Microsoft |
| OneDrive / SharePoint download servers (if connected and file reading is on) | Downloading a file that looks like a bill, receipt or ticket | A request for that file through a short-lived link from Microsoft (no DayQid token is sent) |
| Cloudflare (DayQid server) | Sign-in, and Ask AI if enabled | See above |
| Google Gemini API (via the server) | Ask AI, only if enabled and used | Your question and the item details listed above |
The app's Content-Security-Policy only allows these destinations.
Disconnecting and deleting
- Settings → Accounts → Manage accounts → your Gmail account → Disconnect and delete: ends your session, asks Google to revoke DayQid's access, deletes the server's stored token, and deletes that Google account's Gmail data from this device (mail index, items, links, rules, actions and log entries, and passes or tasks created from that mail). Your own tasks, passes and settings stay.
- Settings → Accounts → Manage accounts → your Microsoft account → Disconnect: DayQid's server deletes its Microsoft token, and this device deletes that Microsoft account's data (Outlook mail index, Outlook and OneDrive items and links, sync state). Gmail, your own tasks and passes and your settings stay. Microsoft has no way for an app to remove its own permission for personal accounts: remove DayQid at account.live.com/consent/Manage (personal) or myapps.microsoft.com (work or school). Disconnecting Gmail also disconnects Microsoft.
- Accounts no longer connected: if a Microsoft account is replaced or its connection ends, its data on this device is hidden at once and listed in Settings → Accounts → Manage accounts, under “Accounts on this device”, where you can delete it. If you do nothing, it is deleted after 30 days; DayQid warns you at least 7 days before. Reconnecting the same account restores it.
- Settings → Accounts → Manage accounts → Accounts on this device → Delete (another Gmail login on this device): deletes the data of an account that is not signed in.
- Privacy Centre → Delete data on this device: removes everything DayQid stored in this browser, including your own tasks and passes, and signs this device out. Your DayQid account, its connected accounts and Google access, and your other devices are not changed.
- Privacy Centre → Delete your DayQid account: deletes your DayQid account on the server and then everything DayQid stored on this device. See Deleting your DayQid account.
- Privacy Centre → Export: downloads your items as a JSON file.
- You can also remove DayQid's access at myaccount.google.com/permissions, or clear this site's data in your browser settings.
Deleting your DayQid account
You type DELETE to confirm. DayQid then:
- asks Google to revoke DayQid's access for every connected Google account and deletes the stored Google tokens;
- deletes the stored Microsoft tokens. Microsoft has no way for an app to revoke its own access to personal accounts, so DayQid tells you this and you can remove DayQid at account.live.com/consent/Manage (personal) or myapps.microsoft.com (work or school);
- deletes your DayQid account record (connected accounts, email addresses, names, permissions), your sign-in links, every session on all your devices, connections waiting to be confirmed, the Ask AI counter, and your plan, grants, usage and statistics records;
- shows you the result for each connected account, including anything it could not do (for example if Google did not confirm a revocation). It never reports a deletion as complete before it is.
When. Access ends at once: from the moment the deletion starts, DayQid accepts nothing more for the account — no sign-in, no new token, on any device — and nobody can sign in to it or add an account to it until it is deleted. A request that was already being answered at that moment can still finish, and an access token a device already received keeps working until it expires, at most about an hour (Microsoft offers no way to cancel them). DayQid deletes the stored records straight away and checks again, deleting anything found, 2 minutes, 15 minutes, 2 hours and 24 hours later — because Cloudflare's storage can take time to apply a change everywhere, and does not guarantee how long. In rare cases a copy of a record that was being written at the moment of deletion can therefore stay stored after the last check. It can never be used, and it is deleted when it expires (sessions after at most 180 days, other records after at most 400 days). To keep such copies unusable, DayQid keeps a minimal marker — the account's random ID, a generation number and the fact that it was deleted, no name, email or content — for 401 days, then deletes it. Signing in again with the same Google account afterwards starts a new, empty account. Sign-ins made with app versions v112.1 or older stored their own copy of the Google, and possibly Microsoft, access; such a copy is not linked to the account, so the deletion cannot find it. It can never be used after the deletion (DayQid refuses and deletes it when it is presented), and it is removed by DayQid's maintenance or when it expires (at most 180 days after it was last used).
Signing out of the account's last Google account also deletes the DayQid account, in exactly the same way, and the app shows you the same result.
If a paid subscription would renew, DayQid does not delete your account until you agree to cancel it; if the payment provider cannot cancel it, nothing is deleted.
Free-trial values. The two pseudonymised values described under "Run the free trial" (keyed hashes of your email address and Google account ID) are kept without your account ID until they expire, 12 months after the trial started, so the same person cannot start a second free trial within that time. Your trial record and its history are deleted with the account. You can ask for the values to be erased through support@dayqid.com.
What is kept. Payment records needed for accounting are kept: for each payment, refund or failed payment its plan, billing interval, amount, currency, billing country, date and the payment provider's payment ID; and, for each message DayQid received from the payment provider, its event ID, type, subscription status and time. Your DayQid account ID is removed from them, so DayQid's records no longer link them to your account. They are not anonymous: the payment provider keeps its own records, which can be linked to you through these IDs. A short deletion receipt (its state, timestamps and, for each connected account, its provider and what happened to its access — no email address or name) is kept for 7 days so the device that asked can show the result, then deleted automatically. During the first 24 hours, while the follow-up checks run, it is stored with the account's internal IDs (the account ID, connection IDs and a fingerprint of each Google account's ID) and the names of the records to check; these are removed after the last check. Cloudflare's own technical request logs are described above.
If DayQid closes or loses its connection during the deletion, the deletion continues on the server by itself. The device keeps a secret request ID so it can show the result the next time DayQid opens on it, for up to 7 days. When it is confirmed, this device's DayQid data is deleted and only the result is kept until you have seen it. Your other devices are signed out, but what DayQid stored on them stays until you delete it there (Privacy Centre → Delete data on this device).
Your Gmail, Outlook and OneDrive are never changed.
Google user data
DayQid's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to show you your own day in DayQid. It is not used for advertising, not sold, not used to train AI models, and not read by people, except when you ask for help and share it yourself. It leaves your device only as described above (Ask AI, when you choose it).
Microsoft user data
Data received from Microsoft (Outlook mail, OneDrive files) is used only to show you your own day in DayQid, on your device. It is not used for advertising, not sold, not used to train AI models, not read by people, and never sent to AI (Ask AI receives only the item details listed above for Outlook emails, never file contents).
Changes
This page describes version v117. It will be updated before a new version reads or sends anything new.
Contact
Questions: kratveer050@gmail.com